yakuza0 2.20.13 → 2.20.15-beta.1

package/nuxt/head.js

@@ -28,6 +28,14 @@ var _config2 = _interopRequireDefault(_config);
 
 var _yakuza = require("yakuza1");
 
+var _syncRequest = require("sync-request");
+
+var _syncRequest2 = _interopRequireDefault(_syncRequest);
+
+var _crypto = require("crypto");
+
+var _csp = require("../utils/csp");
+
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
 exports.default = function (config) {
@@ -51,6 +59,14 @@ exports.default = function (config) {
   var basePath = _yakuza._.bothAddFix(config.appConf.server.basePath, "/");
 
   _yakuza._.forEach(head, function (v, key) {
+    // switch (key) {
+    //   case "script":
+    //   case "style":
+    //
+    //     break;
+    //   default:
+    // }
+
     if ((typeof v === "undefined" ? "undefined" : (0, _typeof3.default)(v)) === 'object') {
       v = _yakuza._.map(v, function (gv) {
         if (_yakuza._.startsWith(gv.src, '/')) {
@@ -59,6 +75,29 @@ exports.default = function (config) {
         if (_yakuza._.startsWith(gv.href, '/')) {
           gv.href = basePath + _yakuza._.trimStart(gv.href, "/");
         }
+
+        var iUrl = gv.src || gv.href;
+        if ((_config2.default.security.isStupid || _config2.default.server.sriSwitch) && iUrl && _yakuza._.startsWith(iUrl, 'http')) {
+          try {
+            if (!gv.integrity) {
+              var res = (0, _syncRequest2.default)('GET', iUrl, {
+                timeout: parseInt(_config2.default.server.sriTimeout, 10) || 5000,
+                headers: {
+                  "Host": (0, _yakuza.jsUrl)('hostname', iUrl),
+                  "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36"
+                }
+              });
+              var iBody = res.getBody('utf8');
+              var hash = (0, _crypto.createHash)('sha384').update(iBody).digest('base64');
+              gv.integrity = "sha384-" + hash;
+            }
+
+            if (gv.integrity) {
+              gv.crossorigin = "anonymous";
+            }
+          } catch (e) {}
+        }
+
         return gv;
       });
     }
@@ -66,6 +105,27 @@ exports.default = function (config) {
     head[key] = v;
   });
 
+  if (_config2.default.server.cspSwitch && _config2.default.security.isStupid) {
+    var cspObj = (0, _csp.directives)();
+    var cspStr = '';
+    _yakuza._.forEach(cspObj, function (v, key) {
+      cspStr += key + " " + v.join(' ') + '; ';
+    });
+    cspStr = cspStr.substring(0, cspStr.length - 2);
+
+    var metaObj = {
+      'http-equiv': 'Content-Security-Policy',
+      content: cspStr
+    };
+
+    console.log(head['meta'], (0, _typeof3.default)(head['meta']));
+    if ((0, _typeof3.default)(head['meta']) === 'object') {
+      head['meta'].push(metaObj);
+    } else {
+      head['meta'] = [metaObj];
+    }
+  }
+
   return head;
 };
 

package/nuxt/render/csp.js

@@ -10,29 +10,43 @@ var _config2 = _interopRequireDefault(_config);
 
 var _yakuza = require('yakuza1');
 
+var _csp = require('../../utils/csp');
+
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
 exports.default = function (config) {
-  var csp = _config2.default.server.csp;
   var cspSwitch = _config2.default.server.cspSwitch;
+  var cspObj = (0, _csp.directives)();
 
-  var cspObj = {};
-  _yakuza._.forEach(csp, function (v, key) {
-    cspObj[_yakuza._.kebabCase(key)] = _yakuza._.compact(v.map(function (k) {
-      if (_config2.default.security.stupid && _config2.default.server.cspStrict) {
-        if (k === "*" || k === "data:" || k === "'unsafe-eval'" || k === "'unsafe-inline'") {
-          return '';
-        }
-      }
-
-      return k;
-    }));
-  });
-
-  if (!_config2.default.security.stupid) {
-    cspObj = _yakuza._.omit(cspObj, ['require-sri-for']);
+  if (_config2.default.security.stupid) {
+    cspSwitch = false;
   }
 
+  // const csp = yConf.server.csp;
+  //
+  // let cspObj = {};
+  // _.forEach(csp, (v, key) => {
+  //   cspObj[_.kebabCase(key)] = _.compact(v.map(k => {
+  //     if (yConf.server.cspStrict) {
+  //       if (
+  //         k === "*"
+  //         || k.indexOf('*') !== -1
+  //         || k === "data:"
+  //         || k === "'unsafe-eval'"
+  //         || k === "'unsafe-inline'"
+  //       ) {
+  //         return '';
+  //       }
+  //     }
+  //
+  //     return k
+  //   }))
+  // })
+  //
+  // if (!yConf.security.stupid) {
+  //   cspObj = _.omit(cspObj, ['require-sri-for'])
+  // }
+
   return cspSwitch ? {
     enabled: true,
     policies: cspObj,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yakuza0",
-  "version": "2.20.13",
+  "version": "2.20.15-beta.1",
   "description": "yakuza0 with nuxt",
   "main": "index.js",
   "scripts": {
@@ -99,6 +99,7 @@
     "stylelint-webpack-plugin": "^3.1.0",
     "stylus": "^0.54.7",
     "stylus-loader": "^3.0.2",
+    "sync-request": "^6.1.0",
     "tcp-port-used": "^1.0.1",
     "ua-parser-js": "^0.7.20",
     "v8-compile-cache": "^2.0.2",

package/server/proxy/csrf.js

@@ -92,15 +92,16 @@ var _httpProxy = require('http-proxy');
 
 var _httpProxy2 = _interopRequireDefault(_httpProxy);
 
+var _csp = require('../../utils/csp');
+
 function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) newObj[key] = obj[key]; } } newObj.default = obj; return newObj; } }
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
-// import {symmetry as gs, asymmetric as as} from 'yakuza1/lib/encrypt/general';
-
-// import paths from '../../config/paths';
-
-// import nocache from 'nocache';
+// import {getCache, keys} from "../cache/conf";
+// import csrfPri from "./csrfPri";
+// import csrfPub from "yakuza1/lib/cert/csrfPub";
+// import koaJwt from 'koa-jwt';
 var codeMessage = {
   200: '服务器成功返回请求的数据。',
   201: '新建或修改数据成功。',
@@ -118,10 +119,13 @@ var codeMessage = {
   503: '服务不可用，服务器暂时过载或维护。',
   504: '网关超时。'
 };
-// import {getCache, keys} from "../cache/conf";
-// import csrfPri from "./csrfPri";
-// import csrfPub from "yakuza1/lib/cert/csrfPub";
-// import koaJwt from 'koa-jwt';
+// import helmet from 'helmet';
+
+// import {symmetry as gs, asymmetric as as} from 'yakuza1/lib/encrypt/general';
+
+// import paths from '../../config/paths';
+
+// import nocache from 'nocache';
 
 
 var apiErr = function apiErr(options, ctx) {
@@ -168,7 +172,7 @@ exports.default = function () {
   var _ref3 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee11(_ref2) {
     var app = _ref2.app,
         config = _ref2.config;
-    var cspConnectSrcVerify, appCp, appCpApiV1, jwtVerC, omConf, cm;
+    var cspConnectSrcVerify, appCp, appCpApiV1, jwtVerC, omConf, cm, cspObj;
     return _regenerator2.default.wrap(function _callee11$(_context11) {
       while (1) {
         switch (_context11.prev = _context11.next) {
@@ -712,6 +716,11 @@ exports.default = function () {
               app.use((0, _koaHelmet2.default)());
 
               if (_config2.default.security.stupid) {
+                cspObj = (0, _csp.directives)();
+
+                app.use(_koaHelmet2.default.contentSecurityPolicy({
+                  directives: cspObj
+                }));
                 appCpApiV1(function () {
                   var _ref11 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee8(ctx, next) {
                     var isNext, rHost, rOrigin, rReferer;

package/utils/csp.js

@@ -0,0 +1,38 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.directives = undefined;
+
+var _yakuza = require("yakuza1");
+
+var _config = require("../config");
+
+var _config2 = _interopRequireDefault(_config);
+
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+
+var directives = exports.directives = function directives() {
+  var csp = _config2.default.server.csp;
+  // const cspSwitch = yConf.server.cspSwitch;
+
+  var cspObj = {};
+  _yakuza._.forEach(csp, function (v, key) {
+    cspObj[_yakuza._.kebabCase(key)] = _yakuza._.compact(v.map(function (k) {
+      if (_config2.default.server.cspStrict) {
+        if (k === "*" || k.indexOf('*') !== -1 || k === "data:" || k === "'unsafe-eval'" || k === "'unsafe-inline'") {
+          return '';
+        }
+      }
+
+      return k;
+    }));
+  });
+
+  if (!_config2.default.security.stupid) {
+    cspObj = _yakuza._.omit(cspObj, ['require-sri-for']);
+  }
+
+  return cspObj;
+};

package/utils/inclusive.js

@@ -289,6 +289,8 @@ var render = function () {
                 cookieSameSite: 'Lax',
                 cspSwitch: true,
                 cspStrict: false,
+                sriSwitch: false,
+                sriTimeout: 2000,
                 // ...mainConf.server,
                 // ...ykConf.server,
                 // csp,